A tale of two PHP remote vulnerabilities

This story outlines the details of two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz, and addressed in PHP October 2026 Security Release. To understand the bugs, first join us on a journey through time...

You can read the original findings on
https://calif.io/php2shell/#writeup

2004. Stefan searches for forbidden knowledge and discovers an ancient PHP artifact.

London, 2020. A detective is called to investigate a bug report.

2024. In the PHP laboratory, a scientist investigates an anomaly: out-of-memory exploitation of unknown origin.

2026, somewhere in Florida. A researcher finds another bug, and is invited to share his findings.

A cloaked figure welcomes the researcher. Inside, a council gathers around a glowing PHP elephant.
the researcher presenting his device to the elephant.

The glowing blue PHP elephant beneath branching blue light out into the internet.